Skip to content
OpenAdvisories
High ALAS2-2023-2321 1 CVE

Important: libxml2 security update (Amazon Linux 2)

Published Oct 30, 2023 · Updated Nov 1, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45322: libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 libxml2 0:2.9.1-6.amzn2.5.13
Amazon Linux · 2 libxml2-debuginfo 0:2.9.1-6.amzn2.5.13
Amazon Linux · 2 libxml2-devel 0:2.9.1-6.amzn2.5.13
Amazon Linux · 2 libxml2-python 0:2.9.1-6.amzn2.5.13
Amazon Linux · 2 libxml2-static 0:2.9.1-6.amzn2.5.13

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-45322.html